CVE-2018-17189

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

The following packages have been upgraded to a later upstream version: mod_http2 (1.15.7). (BZ#1814236)

Security Fix(es):

• httpd: memory corruption on early pushes (CVE-2019-10081)

• httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

• httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

• httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

• httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)

• httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)

• httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)

• httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

• httpd: mod_rewrite potential open redirect (CVE-2019-10098)

• httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

The following packages have been upgraded to a later upstream version: mod_http2 (1.15.7). (BZ#1814236)

Security Fix(es):

• httpd: memory corruption on early pushes (CVE-2019-10081)

• httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

• httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

• httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

• httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)

• httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)

• httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)

• httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

• httpd: mod_rewrite potential open redirect (CVE-2019-10098)

• httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

By sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections in Apache HTTP Server versions 2.4.37 and prior (CVE-2018-17189).

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded (CVE-2018-17199).

The apache package has been updated to version 2.4.38, fixing these issues and several other bugs. See the upstream CHANGES files for details.

This update for apache2 fixes the following issues:

Security issues fixed:

• CVE-2018-17189: Fixed a denial of service in mod_http2, via slow and unneeded request bodies (bsc#1122838)
• CVE-2018-17199: Fixed that mod_session_cookie did not respect expiry time (bsc#1122839)

Non-security issue fixed:

• sysconfig.d is not created anymore if it already exists (bsc#1121086)

This update was imported from the SUSE:SLE-15:Update update project.

This update for apache2 fixes the following issues:

Security issues fixed:

• CVE-2018-17189: Fixed a denial of service in mod_http2, via slow and unneeded request bodies (bsc#1122838)
• CVE-2018-17199: Fixed that mod_session_cookie did not respect expiry time (bsc#1122839)

Non-security issue fixed:

• sysconfig.d is not created anymore if it already exists (bsc#1121086)

This update for apache2 fixes the following issues:

Security issues fixed:

• CVE-2018-17189: Fixed a denial of service in mod_http2, via slow and unneeded request bodies (bsc#1122838)
• CVE-2018-17199: Fixed that mod_session_cookie did not respect expiry time (bsc#1122839)

Non-security issue fixed:

• sysconfig.d is not created anymore if it already exists (bsc#1121086)

Charles Fol discovered that the Apache HTTP Server incorrectly handled the scoreboard shared memory area. A remote attacker able to upload and run scripts could possibly use this issue to execute arbitrary code with root privileges. (CVE-2019-0211)

It was discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain requests. A remote attacker could possibly use this issue to cause the server to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-17189)

It was discovered that the Apache HTTP Server incorrectly handled session expiry times. When used with mod_session_cookie, this may result in the session expiry time to be ignored, contrary to expectations. (CVE-2018-17199)

Craig Young discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain requests. A remote attacker could possibly use this issue to cause the server to process requests incorrectly. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-0196)

Simon Kappel discovered that the Apache HTTP Server mod_auth_digest module incorrectly handled threads. A remote attacker with valid credentials could possibly use this issue to authenticate using another username, bypassing access control restrictions. (CVE-2019-0217)

Bernhard Lorenz discovered that the Apache HTTP Server was inconsistent when processing requests containing multiple consecutive slashes. This could lead to directives such as LocationMatch and RewriteRule to perform contrary to expectations. (CVE-2019-0220)